Live › vulnerability › CVE-2026-114060
Go to dashboardSvelteKit apps using enhanced form actions (use:enhance) on routes that accept paths starting with // can redirect users after form submission. An attacker can use this to send victims to an arbitrary external site, which enables phishing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC, 1h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| @sveltejs/kit | npm | < 3.0.0 | 3.0.0 |
3.0.0 is affected3.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Applications using enhanced form actions (use:enhance) on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect.
A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later.
The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.
Reject requests whose parsed URL pathname begins with // before route resolution, for example in a reverse proxy or a SvelteKit handle hook.
Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:
<form method="POST" use:enhance={() => ({ update }) => update({ navigate: false })}>
<!-- form fields -->
</form>
This applies non-redirect results to the current page instead of navigating to the action location.
This page as .md · .json · in your agent: get_signal("CVE-2026-114060")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.